ASEC reported Kimsuky distributing a malicious JSE dropper disguised as an import declaration to South Korean research institutes. The dropper contains obfuscated PowerShell, a Base64-encoded backdoor, and a benign PDF with target information, then writes a backdoor under ProgramData and executes it with rundll32.exe. The malware copies itself as IconCache.db for scheduled-task persistence, collects antivirus, network, host, user, and OS data, encodes command output for C2, and supports command execution and uploads to rscnode.dothome.co.kr.